OpenVPN install issue - Error -536870329

[Eimerkopp 1]

Hello All.

Just re-installed with Windows 10 (64bit, Enterprise, RS5)

One of my first steps: Getting the VPN going again - downloaded latest version.

 

I can install Eddie and start the UI but openVPN installation fails.
(In Eddie, running OpenVPN setup, trying the tapinstall batch file, or even just righ-clicking and installing the inf file!

 

Error is always the same. Any suggestions?

From batch file:

C:\Windows\system32>"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
Device node created. Install is complete when drivers are installed...
Updating drivers for tap0901 from C:\Program Files\TAP-Windows\driver\OemVista.inf.
UpdateDriverForPlugAndPlayDevices failed, GetLastError=-536870329
tapinstall.exe failed.

 

From OpenVPN installer:

tapinstall.exe hwids returned: 0
TAP update (tap0901) (May require confirmation)
Updating drivers for tap0901 from C:\Program Files\TAP-Windows\driver\OemVista.inf.
UpdateDriverForPlugAndPlayDevices failed, GetLastError=-536870329
tapinstall.exe failed.
tapinstall.exe returned: 2
tapinstall.exe cumulative status: 2
Created uninstaller: C:\Program Files\TAP-Windows\Uninstall.exe
Completed

 

From Eddie:

. 2018.11.13 00:30:55 - Cannot find tunnel adapter.
E 2018.11.13 00:30:56 - OpenVPN Driver - Not available - Will be installed at next connection.
. 2018.11.13 00:30:56 - OpenVPN - Version: 2.4.6 - OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10 (C:\Program Files\AirVPN\openvpn.exe)
. 2018.11.13 00:30:56 - SSH - Version: plink 0.67 (C:\Program Files\AirVPN\plink.exe)
. 2018.11.13 00:30:56 - SSL - Version: stunnel 5.40 (C:\Program Files\AirVPN\stunnel.exe)
. 2018.11.13 00:30:56 - curl - Version: 7.54.1 (C:\Program Files\AirVPN\curl.exe)
. 2018.11.13 00:30:56 - Certification Authorities: C:\Program Files\AirVPN\res\cacert.pem
. 2018.11.13 00:30:56 - Updating systems & servers data ...
I 2018.11.13 00:30:56 - Ready
. 2018.11.13 00:30:57 - Systems & servers data update completed
I 2018.11.13 00:30:59 - Session starting.
. 2018.11.13 00:30:59 - Cannot find tunnel adapter.
! 2018.11.13 00:30:59 - Installing tunnel driver
. 2018.11.13 00:31:05 - Cannot find tunnel adapter.
F 2018.11.13 00:31:05 - Driver installation failed.

 

[OpenSourcerer 1359]

This OpenVPN bug report suggests a plethora of possible hotspots. I even found a very familiar name in it...

• Kaspersky. As it comes shipped with an OpenVPN-like VPN solution, it also installs a driver which needs to go, at least for the time being.
• Windows driver signing feature. Not likely as it works with hundreds of other installations.
• Some weird Windows Update thing blocking installation. Disable the wuauserv service.
• Wrong ownership of C:\Windows\system32\drivers and \DriverStore. Very unlikely but possible if you can't install any drivers.

[Eimerkopp 1]

Nice.

There's some decent leads in there.

• Aside from what MS ships, there's no 3rd party AV, or other snake-oil installed
• Let me check on driver signature issues. (RS5 is still a turd in the making.)
• Only one RS5 cumulative installed. 
• I'll go over C:\Windows\INF\setupapi.dev.log  
• Wrong Ownership of DriverStore - Nope
• unless.... 

It got late last night and I completely forgot I threw on a STIG based security profile which I tend to do by default. 
It's all in a single script, so a routine double-click may have likely put me into this mess.
https://iase.disa.mil/stigs/os/windows/Pages/win10.aspx

 

So, now the question is which setting is at fault?! It's still a virgin install, might be easier to start from scratch but in the end I sure would love to know.

[OpenSourcerer 1359]

Now this is the kind of stuff I'd put into the "idle knowledge" pocket for myself... I'll go through it sometime later. What exactly am I looking at in the zip archive? What are the relevant files? On which one did you double-click?

[Eimerkopp 1]

I created a script, mainly for work to apply a good portion of the described settings.
Found the results good enough to apply them with little modification to non work related installs as well.

 

The issue is resolved for me, for now but I cannot present a root cause.
Going through Group Policy, the obvious settings had no effect my problem. After deleting the whole Group Policy folder, I was able to install OpenVPN.
After that I applied GP again and everything is dandy. Maybe this weekend I have time to look into it in more detail.

 

This is probably the right link with settings explained.
https://nvd.nist.gov/ncp/checklist/629/download/3062

[OpenSourcerer 1359]

Okay. Glad it's resolved, though.

 

Take care